bad unicode in URLs shouldn't cause 500

`decode_argument` doesn't catch unicode errors, so requesting `%FF` or other invalid encoding to a handler capturing `(.*)` will result in 500 errors.

This PR changes the decoding error handling in `decode_argument` to `'replace'`, so it should never raise.